The Pro for BootIt mode has the new boot option to start boot of uefi kernel
loader. It will currently use uefi policy so that it may restrict booting
items in secure boot mode that don't have machine key. For the secondary
internal key, for systems that allow it, it will confirm internal shim key
then attempt to boot if certificate is good (later versions will allow
booting if signed by private key even if system policy prevents it). The
difference between boot/exec is covered in the manual.